Bug 11126

Summary: "su --login" fails when using pam + util-linux
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Patrick Ohly <patrick.ohly>
Component: coreAssignee: Patrick Ohly <patrick.ohly>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium+ CC: meta.mr.watcher, meta.watcher
Version: unspecified   
Target Milestone: 2.4 M2   
Hardware: x86   
OS: Multiple   
Whiteboard: Backport to 2.3.1
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Patrick Ohly 2017-03-06 13:01:22 UTC 
To reproduce, build current poky with this in local.conf:

DISTRO_FEATURES_append = " pam systemd"
VIRTUAL-RUNTIME_init_manager = "systemd"
VIRTUAL-RUNTIME_initscripts = ""
DISTRO_FEATURES_BACKFILL_CONSIDERED = "sysvinit"
IMAGE_INSTALL_append = " util-linux"

The relevant part is enabling pam and installing util-linux. Using systemd probably doesn't matter.

Build core-image-minimal, boot into qemu. Then:

qemux86 login: root
root@qemux86:~# useradd test
root@qemux86:~# /bin/su.util-linux - test
su.util-linux: Authentication failure

This only occurs:
* when using - (aka --login)
* for su from util-linux
* when using pam

The default priorities are:

/bin/busybox.suid 50
/bin/su.shadow 200
/bin/su.util-linux 80

So normally this should occur.

The root cause of the problem is that su.util-linux looks for a pam "su-l" config file instead of the normal "su" config file. When not found, it uses "other", which has "auth pam_deny.so" and thus prevents the operation.

This fixes the problem:
ln -s su /etc/pam.d/su-l

How useful is it to have su.util-linux? Instead of adding su-l I'm leaning towards simply disabling the utility entirely. It's currently in:

PACKAGECONFIG[pam] = "--enable-su --enable-runuser,--disable-su --disable-runuser, libpam,"
Comment 1 Patrick Ohly 2017-03-06 13:01:57 UTC 
(In reply to comment #0)
> The default priorities are:
> 
> /bin/busybox.suid 50
> /bin/su.shadow 200
> /bin/su.util-linux 80
> 
> So normally this should occur.

Should *not* occur.
Comment 2 Ross Burton 2017-06-06 11:26:39 UTC 
Patrick, would you be able to handle this?  Your resolution seems sensible to me.
Comment 3 Patrick Ohly 2017-06-12 11:13:18 UTC 
(In reply to comment #2)
> Patrick, would you be able to handle this?  Your resolution seems sensible
> to me.

Which solution? Symlinking /etc/pam.d/su-l or removing su from util-linux?
Comment 4 Patrick Ohly 2017-07-12 09:03:10 UTC 
(In reply to comment #3)
> (In reply to comment #2)
> > Patrick, would you be able to handle this?  Your resolution seems sensible
> > to me.
> 
> Which solution? Symlinking /etc/pam.d/su-l or removing su from util-linux?

symlink fix set to the list: "util-linux: fix "su -" and package su separately"
Comment 5 Patrick Ohly 2017-08-01 09:39:19 UTC 
Fixed in "util-linux: fix "su -" and package su separately".